backCMS Releases Guidance on State Directed Payments in Connection with Section 71116 of the One Big Beautiful Bill Act
On September 9, 2025, CMS issued a guidance letter on Section 71116 of the One Big Beautiful Bill Act, which became effective for Medicaid managed care rating periods beginning on or after July 4, 2025. The provision requires CMS to lower the total payment rate limits for State Directed Payments (SDPs). CMS’s September 9 guidance letter provides important clarity on how Section 71116 will be implemented and explains which SDPs qualify for temporary grandfathering, the approval and submission deadlines that apply, the limits placed on grandfathered programs, and CMS’s enforcement approach.
For hospitals, the key takeaway is that certain SDPs may continue until 2028 at existing levels, but the amounts are frozen, and all programs will ultimately be subject to Medicare-based caps. While CMS explained that the guidance is preliminary and will be followed by formal rulemaking, including a forthcoming proposed rule, the letter provides important clarity for states and hospitals as they prepare for the new requirements.
Overview
SDPs permit states to implement contractual Medicaid managed care arrangements that direct a managed care organization’s expenditures under 42 C.F.R. § 438.6(c), such as requiring managed care organizations to make specific payments to providers beyond standard rates. Under Section 71116, SDPs for these services are capped at 100% of the Medicare payment rate (or the Medicaid state plan rate if no Medicare rate exists) in expansion states, and 110% of the Medicare payment rate (or the state plan rate) in non-expansion states. With SDP spending projected to exceed $144 billion in 2026, these limits represent a significant change for hospitals that depend on these payments.
Grandfathering of Certain SDPs
The September 9 letter provides direction on the temporary grandfathering period established in Section 71116(b). Grandfathering allows certain SDPs to continue until rating periods beginning on or after January 1, 2028, after which all programs must comply with the new limits.
To qualify, two conditions must be met:
- Timing of the rating period. The SDP must fall within a rating period that occurs within 180 days before or after July 4, 2025. CMS interprets this to include State Fiscal Year (SFY) 2025, Calendar Year (CY) 2025, and SFY 2026. Older rating periods such as SFY 2024 and CY 2024, and later ones such as CY 2026 and SFY 2027, do not qualify.
- Approval or submission status. Section 71116 provides that, to qualify for grandfather status, a state must have received written prior approval of the SDP before May 1, 2025, or have made a “good faith effort” to receive such approval. In its September 9 letter, CMS explained that it interprets “good faith effort” to mean the submission of a completed preprint.
If both conditions are satisfied, the SDP qualifies for the temporary grandfathering period.
CMS explained that grandfathered SDPs are subject to specific parameters. The total dollar amount specified in the approved or submitted preprint is fixed and cannot be increased during the grandfathering period. This restriction applies to revisions, amendments, and renewals. States may reduce the amount if they choose, but increases are not permitted.
If a state has more than one qualifying SDP across rating periods, CMS will allow the higher of the two amounts to serve as the grandfathered baseline. This approach ensures that states are not locked into a lower figure if multiple submissions overlap during the transition.
For hospitals, this means that grandfathered SDPs may continue at existing amounts until 2028, which provides short-term stability. However, those payments are frozen at their current levels unless federal law is altered in the future. Beginning January 1, 2028, even grandfathered programs must be phased down to comply with the new Medicare-based limits.
Next Steps and Enforcement
The letter also describes CMS’s enforcement process. Any SDP preprint that does not qualify for grandfathering must be revised to comply with Section 71116 before CMS will complete its review. For example, a pending CY 2026 or SFY 2027 preprint that exceeds the statutory cap must be adjusted before review continues. Amendments or renewals of SDPs that do not qualify for grandfathering must also be revised if they exceed the limits. CMS will not continue reviewing preprints that are inconsistent with the law.
CMS indicated that adjudication letters will include preliminary feedback on whether SDPs are likely to qualify for grandfathering. These determinations, along with final approvals, will continue to be posted publicly on Medicaid.gov on a routine basis. CMS also noted that its assessments may change if new information comes to light or if future regulatory changes require it.
A copy of the September 9 letter is available here.
Reporter, Dennis Mkrtchian, Los Angeles, + 1 213 218 4046, dmkrtchian@kslaw.com.
FTC Warns Healthcare Employers Against Noncompetes
On September 10, 2025, FTC Chairman Andrew N. Ferguson issued letters to several healthcare employers and staffing companies urging them to carefully review their use of noncompetes or other restrictive terms in their employment agreements. The letters emphasized that the FTC is aware that many healthcare employers include noncompete provisions in employment contracts and believes that such provisions may have “harmful effects” on the healthcare industry because they can limit employment options for physicians, nurses, and other healthcare staff, and limit patient options in selecting a healthcare provider.
Chairman Ferguson’s letters encouraged the healthcare employers to conduct a thorough review of their employment agreements to make sure they comply with applicable laws including the FTC Act. Under Section 5 of FTC Act, noncompete agreements that amount to unfair competition (e.g. those that are overbroad in duration or geographic scope) may be found to be unlawful.
The main takeaway from these letters is that even though the current FTC has abandoned efforts to defend its predecessor’s nationwide noncompete ban, it remains focused on combatting efforts to limit employee mobility, especially in the healthcare sector. As such, healthcare organizations need to remain vigilant about reviewing their employment agreements and ensuring that they do not contain restrictions that can be characterized as anticompetitive.
King & Spalding’s Antirust and Global Human Capital and Compliance teams are ready to assist clients in responding to the FTC letters.
A link to the press release is available here. A link to the FTC’s letter is available here.
Reporter, Brittni Hamilton, Los Angeles, +1 213-218-4083, bhamilton@kslaw.com.
OIG Audit of Novitas Medicare Administrative Contractor Identifies Desk Review Errors in All Reviewed Cost Report Reopenings
On September 2, 2025, OIG published the results of an audit that found obvious errors and/or inconsistencies with Medicare requirements in all 122 of the cost reports reviewed (i.e., cost reports for which Novitas had settled after only a desk review and later reopened to correct the final settlement amounts). The audit identified $5 million in overpayments and $4.4 million in underpayments to providers as a result of the errors. OIG recommended, and Novitas concurred, that further training and expanded procedures are necessary for Novitas desk reviewers and supervisors.
Novitas is a Medicare Advantage Contractor (MAC) that reviews cost reports submitted by healthcare providers to determine the final amount of Medicare reimbursement due to the providers for a specific cost reporting period. Cost reports include worksheets with information on facility characteristics, health care utilization, employee salary and wage data, facility costs and charges, and Medicare settlement data. The MAC performs a desk review of the cost report before issuing a Notice of Program Reimbursement (NPR) to the provider. The desk review entails an analysis by the MAC of the cost report to determine its accuracy and reasonableness and to determine whether the cost report requires an audit. Presuming the MAC determines that a full audit is unnecessary, it will issue an NPR after its desk review. The NPR shows whether the Medicare program owes payment to the provider or if the provider owes payment to the Medicare program. Novitas is the MAC for eleven states and the District of Columbia.
The purpose of OIG’s audit was to determine whether the cost reports, settled with only a desk review and later reopened for correction, contained obvious errors and/or were inconsistent with the law, regulations, or Medicare manual instructions. The audit also determined whether such errors/inconsistencies were caused by Novitas.
According to OIG, all 122 cost report reopenings contained obvious errors or were inconsistent with the law, regulations, or Medicare manual instructions, and those errors/inconsistencies were caused by Novitas. The report detailed eleven categories of errors, including settlement data omissions, misreported Health Information Technology for Economic and Clinical Health Act (HITECH) payments, duplicated bad debts, and incorrect Graduate Medical Education (GME) calculations. Errors included such things as using “an incorrect HITECH transition factor . . . for the HITECH settlement,” “an incorrect per-resident amount (PRA) for GME payments,” and an “incorrect Supplemental Security Income (SSI) percentage for DSH payments.”
The reopenings resulted in corrected settlements totaling $9.4 million, including $5 million in overpayments and $4.4 million in underpayments.
Novitas concurred with OIG’s recommendations that Novitas (1) develop and provide additional education to desk reviewers and supervisors regarding applicable criteria and review requirements; and (2) develop and implement enhanced and expanded procedures not limited to the additional training for which Novitas had already identified a need, so that supervisors are better qualified to detect incorrect adjustments.
Given the widespread errors found by OIG, providers would be wise to scrutinize and verify all audit adjustments and findings that their MACs make in the settlement of their NPRs.
The full text of OIG’s Audit A-06-24-05003, “Novitas Solutions, Inc., Reopened and Corrected Cost Report Final Settlements for Desk Reviews Only With Obvious Errors To Correct Payments Made to Medicare Providers,” is available here.
Reporter, Kasey Ashford, Washington D.C., +1 202 626 2906, kashford@kslaw.com.
GAO Report Finds National Coverage Determinations Usually Issued within Specified Timeframes but Also Makes Recommendations for Improvements
On September 9, 2025, the Government Accountability Office (GAO) published a report titled “National Coverage Determinations Are Generally Timely, but Improvements Are Needed” (the Report). CMS makes national coverage determinations (NCDs) for Medicare beneficiaries to decide what health care items and services are covered by Medicare. The Report found that while CMS completed most NCDs within the required timeframes, several exceed the required timeframes by up to 351 days.
An NCD is a determination by CMS whether Medicare will pay for certain items or services. The NCD process starts with a request asking CMS to establish, expand, limit, or remove coverage for an item or service. The entire process can comprise as many as 16 steps, including analysis steps. The analysis steps include actions such as reviewing clinical research papers and assessing their validity. In 2013, CMS published notice in the Federal Register that the analysis steps of the NCD process should not take more than 9 to 12 months.
The Report had two main objectives: (1) to examine the extent to which CMS finalized the analysis steps within the specified time frames and addressed any gaps; and (2) to inspect reported challenges in the process for deciding on coverage of health care items and services and CMS’s efforts to address that process. GAO reviewed CMS’s Medicare coverage process policies, guidance policies, and administrative data. GAO also interviewed officials at CMS, FDA, and the Agency for Healthcare Research and Quality. Moreover, GAO interviewed stakeholders, such as requesters of NCDs.
The Report examined 53 NCD analyses from October 2012 through February 2025. The Report found that 44 out of the 53 analyses took place within the required time frame of 9 to 12 months. The remaining 9 analyses took a range of 6 to 351 days longer than the required time frame. CMS officials attributed the delays to COVID-19 and other factors, but the Report highlighted that CMS has not systematically analyzed the cause of the delays. The Report also emphasized that CMS has not been transparent about how it prioritizes NCD requests. However, according to the Report, CMS has made efforts to address its growing workload and improve communications with requestors.
GAO made two recommendations to CMS. First, GAO recommended that CMS identify the causes of NCD delays to better ensure that analyses are finalized within specified time frames. Second, GAO recommended that CMS make available to the public the criteria it uses to prioritize coverage analyses. HHS concurred with GAO’s recommendations.
Reporter, Priya Sinha, Atlanta, +1 404 572 3548, psinha@kslaw.com.
Upcoming Events
King & Spalding 12th Annual Cybersecurity & Privacy Summit
Tuesday, September 30 at 10:00 A.M. – 6:00 P.M. ET
- In-Person & Virtual
Join King & Spalding for the 12th Annual Cybersecurity & Privacy Summit, an immersive program dedicated to sharing key lessons, best practices, and the latest critical trends shaping the world of cybersecurity and privacy. This year, our theme “Navigating the Future: Empowering Innovation, Protecting Data and Prioritizing Privacy” sets the stage for insightful dialogue and practical guidance.
The Summit will feature distinguished data, privacy and security lawyers; in-house counsel; and leading industry experts who will focus on balancing innovation with risk management, sharing insights into new and upcoming privacy regulations, exploring the evolving threat landscape and more. Mark your calendar and join us for a dynamic program designed to address the most pressing issues in the field.
Further program announcements will follow, with the full agenda to be released in the coming weeks.
Please RSVP by September 19. The page to RSVP for the summit can be found here. For questions, contact the K&S Events Team.
King & Spalding Health Law & Policy Forum West
Wednesday, October 15, 8:30 A.M. – 6:00 P.M. PT
- The Ritz-Carlton, Marina del Rey
Join our distinguished faculty and industry leaders for our annual Health Law & Policy Forum West in Marina del Rey. As the healthcare industry continues to evolve in response to economic pressures, patient needs and accelerating technological advances, this full-day program will cover the trending topics that lawyers, executives, managers and investors need to know as they adapt to changes associated with the new administration and more. A keynote session featuring Chad Golder, general counsel of the American Hospital Association, and Rob Hur, former special counsel and U.S. attorney, and current King & Spalding partner, will discuss key issues facing the healthcare industry. Additionally, our partner Rob DeConti, former chief counsel to the Department of Health and Human Services (HHS OIG), will provide his insights into the OIG’s enforcement priorities and share his thoughts on the emerging enforcement trends and compliance issues.
Attendees will also enjoy multiple networking opportunities, including a reception following the sessions.
Register by September 5. Registration is available here and is $95 per person. For questions, contact the K&S Events Team.
Editors: Chris Kenny and Ahsin Azim
Issue Editors: Jenna Anderson and Doug Comin